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Findings  (cont'd) 


Objective 

Our  audit  objective  was  to  determine 
whether  selected  DoD  Components  were 
effectively  consolidating  their  data  centers 
in  accordance  with  the  Federal  Data 
Center  Consolidation  Initiative  (FDCCI). 
Specifically,  we  planned  to  verify  the 
status  of  the  consolidations  and  determine 
whether  actual  efficiencies  gained  met  the 
estimated  efficiencies  reported  to  the  Office 
of  Management  and  Budget  (0MB).  Because 
DoD  acknowledged  the  significant  challenges 
to  realizing  efficiencies,  we  focused  on 
determining  whether  DoD  effectively 
consolidated  data  centers  in  accordance 
with  FDCCI  and  DoD  requirements  for  data 
center  consolidation. 

Findings 

DoD  did  not  meet  the  FDCCI  requirement  to 
consolidate  40  percent  of  its  data  centers 
by  yearend  FY  2015.  Of  the  3,115  data 
centers  reported  in  DoD's  Data  Center 
Inventory  Management  (DCIM)  system, 
only  568  (18  percent)  were  closed  by 
fiscal  yearend.  This  occurred  because  the 
DoD  Chief  Information  Officer  (CIO)  did  not 
revise  DoD's  strategy  to  meet  the  40-percent 
goal  for  data  center  reduction  after  OMB 
revised  the  definition  of  a  data  center  to 
include  smaller  facilities.  In  addition,  the 
DoD  CIO  did  not  enforce  compliance  with 
the  DoD  requirement  for  one  installation 
processing  node  per  installation.  As  a 
result,  DoD  will  not  reduce  its  energy  and 
real  estate  footprint  or  achieve  the  cost 
savings  outlined  in  the  FDCCI.  Even  with 
planned  closures,  DoD  will  not  reach  its 
internal  goal  to  reduce  the  number  of  data 
centers  by  60  percent  by  FY  2018. 


We  nonstatistically  reviewed  119  of  1,501  data  centers  owned 
by  the  Army,  Marine  Corps,  Navy,  and  the  Defense  Information 
Systems  Agency  (DISA).  We  did  not  include  the  Air  Force  in 
the  sample  because  an  Air  Force  CIO  official  acknowledged 
the  Air  Force  severely  underreported  the  number  of  data 
centers  the  Air  Force  owns  and  operates.  We  determined 
that  68  of  the  119  data  centers  did  not  report  accurate  DCIM 
information.  This  occurred  because  the  DoD  CIO  did  not 
issue  clear  guidance  on  recording  and  updating  data  center 
information  in  DCIM.  In  addition,  the  DoD  CIO  and  Component 
CIOs  did  not  implement  an  effective  process  to  validate  the 
accuracy  of  DCIM  data.  As  a  result,  there  is  an  increased  risk 
that  Congress  and  other  stakeholders  could  inappropriately 
assess  DoD's  cost  savings  and  efficiencies  gained  through  data 
center  reduction. 

Recommendations 

We  recommend  that  the  DoD  CIO  revise  its  strategy  to  include 
a  plan  for  meeting  its  60-percent  data  center  reduction  goal 
by  FY  2018  and  a  process  for  monitoring  Component  progress 
toward  meeting  the  data  center  consolidation  goals.  We  also 
recommend  that  the  Military  Service  CIOs  and  the  DISA  CIO 
revise  their  process  for  validating  DCIM  information  to  ensure 
accuracy  and  completeness.  Additional  recommendations 
appear  in  the  full  report. 

Management  Comments  and 
Our  Response 

Based  on  management  comments,  we  redirected  one 
recommendation  to  the  Department  of  the  Navy  CIO.  The 
DoD  CIO;  Army  Deputy  CIO,  responding  for  the  Army  CIO; 

Navy  CIO;  and  Air  Force  Chief,  Information  Dominance  and 
CIO  addressed  all  specifics  of  the  recommendations,  and 
no  further  comments  are  required.  Although  the  DISA  CIO 
partially  agreed  with  Recommendation  B.2,  we  disagree  with 
his  assertion  that  two  DISA  facilities  are  not  data  centers  and 
should  not  be  included  in  DCIM.  We  request  that  the  DISA  CIO 
provide  additional  comments  on  this  report  by  April  29,  2016. 
Please  see  the  Recommendations  Table  on  the  next  page. 
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MEMORANDUM  FOR  CHIEF  INFORMATION  OFFICER,  DEPARTMENT  OF  DEFENSE 
CHIEF  INFORMATION  OFFICER,  DEPARTMENT  OF  THE  ARMY 
CHIEF  INFORMATION  OFFICER,  MARINE  CORPS 
CHIEF  INFORMATION  OFFICER,  DEPARTMENT  OF  THE  NAVY 
CHIEF  INFORMATION  OFFICER,  DEPARTMENT  OF  THE  AIR  FORCE 
CHIEF  INFORMATION  OFFICER,  DEFENSE  INFORMATION 
SYSTEMS  AGENCY 

SUBJECT:  DoD’s  Efforts  to  Consolidate  Data  Centers  Need  Improvement 
(Report  No.  DODIG-2016-068) 

We  are  providing  this  report  for  review  and  comment.  DoD  did  not  effectively  consolidate  data 
centers  in  accordance  with  the  Federal  Data  Center  Consolidation  Initiative  and  DoD  data  center 
consolidation  requirements.  In  addition,  DoD  Components  did  not  accurately  report  data  center 
information  to  the  DoD  Chief  Information  Officer  (CIO).  We  conducted  this  audit  in  accordance 
with  generally  accepted  government  auditing  standards. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  DoD  Instruction  7650.03  requires  that  recommendations  be  resolved  promptly.  We 
redirected  Recommendation  B.2  to  the  Department  of  the  Navy  CIO  because  the  CIO  has  the 
authority  to  implement  the  recommendation  for  Deputy  CIO-Navy  and  Deputy  CIO-Marine 
Corps  actions.  Comments  from  the  DoD  CIO;  Deputy  CIO  for  the  Army,  responding  for  the 
Department  of  the  Army  CIO;  Department  of  the  Navy  CIO;  and  Air  Force  CIO  addressed  the 
specifics  of  Recommendations  A.l,  A. 2,  B.l.a,  B.l.b,  and  B.2  and  conformed  to  the  requirements 
of  DoD  Instruction  7650.03.  However,  comments  from  the  Defense  Information  Systems  Agency 
CIO  partially  addressed  the  specifics  of  Recommendation  B.2.  We  request  additional  comments 
from  the  Defense  Information  Systems  Agency  CIO  on  Recommendation  B.2  by  April  29,  2016. 

Please  provide  comments  that  conform  to  the  requirements  of  DoD  Instruction  7650.03. 

Please  send  a  PDF  file  containing  your  comments  to  audrco@dodig.mil.  Copies  of  your 
comments  must  have  the  actual  signature  of  the  authorizing  official  for  your  organization. 

We  cannot  accept  the  /Signed/  symbol  in  place  of  the  actual  signature.  If  you  arrange  to 
send  classified  comments  electronically,  you  must  send  them  over  the  SECRET  Internet 
Protocol  Router  Network  (SIPRNET).  Comments  provided  on  the  draft  report  must  be 
marked  and  portion-marked,  as  appropriate,  in  accordance  with  DoD  Manual  5200.01.  If  you 
consider  any  matters  to  be  exempt  from  public  release,  you  should  mark  them  clearly  for 
Inspector  General  consideration. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  699-7331  (DSN  449-7331). 


Carol  N.  Gorman 
Assistant  Inspector  General 
Readiness  and  Cyber  Operations 
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Introduction 

Objective 

Our  audit  objective  was  to  determine  whether  selected  DoD  Components  were 
effectively  consolidating1  their  data  centers  in  accordance  with  the  Federal  Data 
Center  Consolidation  Initiative  (FDCCI).  Specifically,  we  planned  to  verify  the 
status  of  the  consolidations  and  determine  whether  actual  efficiencies  gained  met 
the  estimated  efficiencies  reported  to  the  Office  of  Management  and  Budget  (OMB). 

We  planned  to  compare  actual  efficiencies  gained  with  estimated  efficiencies 
reported.  However,  we  focused  on  determining  whether  DoD  effectively 
consolidated  data  centers  in  accordance  with  FDCCI  and  DoD  data  center 
consolidation  because  DoD  acknowledged  significant  challenges  to  realizing 
efficiencies.  Specifically,  we  reviewed  the  Army,  Marine  Corps,  Navy,  Air  Force,  and 
the  Defense  Information  Systems  Agency  (DISA)  data  center  consolidation  efforts. 
For  a  discussion  on  the  scope  and  methodology,  and  prior  audit  coverage,  please 
see  Appendix  A. 

Background 

In  February  2010,  OMB  established  the  FDCCI,2  in  part  to  reverse  the  growth  of 
data  centers  in  the  Federal  Government.  The  FDCCI's  strategic  goal  was  for  Federal 
agencies  to  close  40  percent  of  their  data  centers  by  yearend  FY  2015.  Overall,  the 
FDCCI  aims  to: 

•  promote  green  information  technology  (IT)3  to  reduce  the  energy  and  real 
estate  footprint  of  Government  data  centers; 

•  reduce  the  cost  of  data  center  hardware,  software,  and  operations; 

•  increase  the  overall  IT  security  posture  in  the  Government;  and 

•  shift  IT  investments  to  more  efficient  computing  platforms 
and  technologies. 


1  For  this  audit,  consolidated  data  centers  include  those  that  reduced  information  technology  assets,  merged  with 
another  data  center,  or  closed. 

2  Federal  Data  Center  Consolidation  Initiative,  February  26,  2010. 

3  Green  IT  minimizes  negative  environmental  impact  of  IT  operations  by  ensuring  that  computers  and  computer-related 
products  are  designed,  manufactured,  operated,  and  disposed  of  in  an  environmentally  friendly  manner. 
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Federal  Government  Data  Centers 

In  October  2010,  OMB  defined  a  data  center  as  any  room  larger  than 
500  square  feet  devoted  to  data  processing  that  met  a  tier  (I,  II,  III,  and  IV)4 
classification.5  As  of  July  2010,  Federal  agencies  reported  that  2,094  Federal 
data  centers  met  that  definition.  In  March  2012,  OMB  realized  that  data  center 
facilities  smaller  than  500  square  feet  also  consumed  significant  resources.  OMB 
concluded  that  closing  those  small  facilities  would  increase  agency  IT  efficiencies 
and  enable  agencies  to  deliver  better  services  to  the  American  taxpayer.  As  a 
result,  in  March  2012,  OMB  revised  the  definition  of  a  data  center  as  a  closet, 
room,  floor,  or  building  for  the  storage,  management,  and  dissemination  of  data 
and  information,  which  contains  computer  systems  and  associated  components, 
such  as  databases,  applications,  storage  systems,  and  data  stores.6  The  revised 
definition  caused  the  number  of  data  centers  managed  by  DoD  to  increase  from 
772  in  FY  2010  to  more  than  1,000  in  FY  2012.  The  number  continued  to  increase 
as  DoD  Components  discovered  more  data  centers  based  on  the  revised  definition. 
By  yearend  FY  2015,  DoD  reported  3,115  data  centers. 

DoD's  Data  Center  Consolidation  Plan 

In  November  2011,  DoD  submitted  to  OMB  a  consolidation  plan  and  progress  report 
with  details  of  DoD’s  strategic  objectives  for  consolidating  data  centers.  DoD’s 
objectives  were  to: 

•  reduce  cost; 

•  reduce  environmental  impact; 

•  improve  efficiency  and  service  levels  through  automation;  and 

•  enhance  business  agility  and  effectively  manage  change. 

DoD’s  data  center  consolidation  plan  identified  the  following  challenges  to 
determining  actual  cost  savings: 

•  obtaining  cost  savings  when  the  personnel  who  managed  the  closed  or 
consolidated  data  centers  were  reassigned  to  other  positions; 

•  measuring  power  consumption  when  power  was  not  metered  at  most 
data  centers; 


4  Based  on  Uptime  Institute  definitions,  Tier  I  is  a  basic  data  center  with  nonredundant  capacity;  Tier  II  has  redundant 
capacity;  Tier  III  has  redundant  capacity  with  dual  power;  and  Tier  IV  has  multiple,  independent,  physically  isolated 
systems  that  each  have  redundant  capacity.  Redundant  capacity  means  the  data  center  infrastructure  includes  backup 
components  that  will  activate  if  the  primary  resources  fail. 

5  Update  on  the  Federal  Data  Center  Consolidation  Initiative,  October  1,  2010. 

6  Implementation  Guidance  for  the  Federal  Data  Center  Consolidation  Initiative  (FDCCI),  March  19,  2012. 


2  |  DODIG-2016-068 


Introduction 


•  determining  cost  savings  when  data  center  floor  space  and  facilities  were 
repurposed  for  other  uses  such  as  office  space  and  telecommunication 
facilities;  and 

•  increasing  IT  resources  at  consolidated  data  center  facilities  to  account  for 
the  increase  in  servers,  systems,  and  applications. 

Despite  these  challenges,  DoD’s  preliminary  cost  savings  estimate  indicated  savings 
of  $680  million  by  FY  2015.  Specifically,  DoD  stated  it  could  achieve  annual  savings 
of  $58  million  in  energy  costs;  $511  million  in  data  center  building  operational 
costs;  and  $111  million  in  construction  and  expansion  costs. 

DoD  Data  Centers 

In  September  2012,  DoD  published  the  Core  Data  Center  Reference  Architecture, 
which  defined  the  following  four  types  of  DoD  data  centers. 

•  Core  Data  Center  (CDC):  A  highly  capable  data  center  that  provides 
standardized  hosting  and  storage  services  to  the  enterprise.  CDCs 
consolidate  computing  and  storage  services  hosted  across  hundreds  of 
Component  facilities. 

•  Installation  Processing  Node  (IPN):  A  data  center  that  serves  a  single  DoD 
installation  and  local  area7  with  local  services  that  cannot  be  provided 
from  a  CDC.  Each  DoD  installation  should  have  only  one  IPN,  but  each  IPN 
may  serve  multiple  enclaves8  to  accommodate  unique  installation  needs 
(for  example,  joint  installations). 

•  Special  Purpose  Processing  Node  (SPPN):  A  data  center  that  supports 
functions  that  cannot  be  supported  by  CDCs  or  IPNs  because  of  the 
SPPN’s  association  with  local  infrastructure  or  equipment,  such  as 
communications  and  networking,  manufacturing,  training,  education, 
meteorology,  medical,  modeling  and  simulation,  and  test  ranges. 
General-purpose  processing  and  general-purpose  storage  cannot  be 
provided  by  or  through  an  SPPN,  and  an  SPPN  has  no  direct  connection 
to  the  DoD  Information  Network.9 

•  Tactical/Mobile  Processing  Nodes:10  A  data  center  similar  to  a  CDC, 
optimized  for  the  tactical  or  deployed  environment.  Depending  on 
circumstances,  tactical  processing  nodes  may  connect  to  the  DoD 
Information  Network  through  DoD  satellite  communications. 


7  Installations  physically  or  logically  behind  the  network  boundary. 

8  A  collection  of  information  systems  connected  by  one  or  more  internal  networks  under  the  control  of  a  single 
authority  and  security  policy.  The  systems  may  be  structured  based  on  physical  proximity  or  on  function,  independent 
of  location. 

9  The  DoD  Information  Network  (formerly  the  Global  Information  Grid)  includes  information  capabilities  that  enable 
access  to,  exchange  of,  and  use  of  information  and  services  throughout  DoD  and  with  non-DoD  individuals  and 
organizations  that  exchange  information  with  DoD  users. 

10  DoD  is  not  required  to  report  Tactical/Mobile  Processing  Nodes  as  part  of  the  data  center  consolidation  effort. 
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Guidance  on  DoD  Data  Center  Consolidation 

The  DoD  Chief  Information  Officer  (DoD  CIO)  issued  the  following  guidance  to  DoD 
Components,  among  others,  on  closing  and  consolidating  data  centers. 

•  Identification  of  Department  of  Defense  Data  Center  Types, 

November  1,  2012.  DoD  Components  were  required  to  provide  projected 
closure  dates  for  noncore  data  centers  (IPNs  and  SPPNs).11 

•  DoD  Component  Data  Center  Consolidation  Implementation  Plans, 

July  11,  2013.  DoD  developed  an  internal  data  center  reduction  goal  of 
60  percent  of  all  DoD  data  centers  by  yearend  FY  2018.  DoD  Components 
were  required  to  submit  implementation  plans  describing  how  they 
planned  to  meet  that  goal. 

•  Changes  in  DoD  Data  Center  Inventory  and  Consolidation 
Implementation  Plan  Reporting  Requirements,  March  31,  2015.  The 
DoD  CIO  canceled  the  DoD  Component  requirement  to  provide 
implementation  plans  for  data  center  consolidation  and  identified  the 
Data  Center  Inventory  Management  (DCIM)  system  as  the  authoritative 
database  for  data  center  inventory  and  implementation  milestones. 

On  April  30,  2015,  the  DoD  CIO  designated  DCIM  data  as  valid  and 
began  using  it  to  report  data  center  closures  to  OMB,  Congress,  the 
Government  Accountability  Office,  and  other  DoD  stakeholders. 

Review  of  Internal  Controls 

DoD  Instruction  5010.4012  requires  DoD  organizations  to  implement  a 
comprehensive  system  of  internal  controls  that  provides  reasonable  assurance 
that  programs  are  operating  as  intended  and  to  evaluate  the  effectiveness  of  the 
controls.  We  identified  an  internal  control  weakness  related  to  the  accuracy  of 
DCIM  data.  The  DoD  CIO  and  Military  Component  CIOs  lacked  a  comprehensive 
process  to  ensure  the  inventory  data  in  DCIM  were  accurate.  We  will  provide  a 
copy  of  the  report  to  the  senior  officials  responsible  for  internal  controls  at  the 
Office  of  the  DoD  CIO,  the  Military  Services,  and  DISA. 


11  Noncore  data  centers  are  IPNs,  SPPNs,  and  Tactical/Mobile  Processing  Nodes. 

12  DoD  Instruction  5010.40,  "Managers'  Internal  Control  Program  Procedures,"  May  30,  2013. 
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Finding  A 


DoD  Did  Not  Meet  the  FDCCI  Requirement 


DoD  did  not  meet  the  FDCCI  requirement  to  consolidate  40  percent  of  its  data 
centers  by  yearend  FY  2015.  Of  the  3,115  data  centers  reported  in  DCIM  at  yearend 
FY  2015,  only  568  (18  percent)  were  reported  as  closed.  This  occurred  because 
the  DoD  CIO  did  not  revise  its  strategy  to  reduce  data  centers  by  40  percent  after 
OMB  revised  the  data  center  definition  to  include  smaller  facilities.  In  addition, 
the  DoD  CIO  did  not  enforce  compliance  with  the  DoD  requirement  of  one  IPN  per 
installation.  As  a  result,  DoD  will  not  reduce  its  energy  and  real  estate  footprint 
or  achieve  the  cost  savings  as  intended  by  the  FDCCI.  In  addition,  even  with  the 
planned  closure  of  796  additional  data  centers  from  FY  2016  through  FY  2018, 13 
only  1,364  (44  percent)  will  be  closed  and  DoD  will  not  meet  its  internal  goal  to 
reduce  the  number  of  data  centers  by  60  percent  by  yearend  FY  2018. 


Minimal  Progress  Consolidating  DoD's  Data  Centers 


~oD  did  not  consolidate  its  data  centers  by  40  percent 
in  accordance  with  the  FDCCI.  Specifically,  as  of 
September  30,  2015,  DoD  had  reduced  the  number  of  data 
centers  by  only  18  percent.14  Table  1  shows  the  progress  of 
each  Military  Service,  DISA,  and  all  other  DoD  Components 
in  consolidating  data  centers,  as  reported  in  DCIM. 


13  Planned  additional  closures  as  of  September  30,  2015. 

14  As  of  December  31,  2015,  DoD  closed  an  additional  32  data  centers.  However,  the  data  center  inventory  increased  from 
3,115  to  3,345.  This  increase  did  not  affect  the  closure  percentage. 
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Table  1.  DoD  Data  Center  Consolidation  Progress  (as  of  September  30,  2015) 


Component 

Number  of 

Data  Centers 

Number  of  Data 
Centers  Closed 

Percentage  of  Data 
Centers  Closed1 

Army 

1,162 

352 

30 

Marine  Corps 

90 

11 

12 

Navy 

307 

47 

15 

Air  Force 

1,088 

69 

6 

DISA 

24 

7 

29 

All  Other  DoD  Components 

444 

82 

18 

Total 

3,115 

5682 

18 

1  Numbers  are  rounded  to  the  next  whole  number  after  0.5  to  improve  readability. 

2  This  figure  reflects  data  centers  that  actually  closed  per  DCIM.  It  does  not  include  84  data  centers 
that,  according  to  DCIM,  had  not  closed  as  planned  by  yearend  of  FY  2015. 


No  Revised  Strategy  for  Consolidating  Data  Centers 

The  DoD  CIO  did  not  revise  its  March  2010  data  center  consolidation  strategy  to 
account  for  the  increased  number  of  data  centers  after  OMB  revised  the  data  center 
definition  to  include  smaller  facilities.  OMB’s  revised  definition  caused  the  number 
of  data  centers  managed  by  DoD  to  increase  from  772  to  more  than  1,000.15  The 

_____  number  continued  to  increase  as  DoD  Components  discovered 
more  data  centers  based  on  the  revised  definition. 
However,  DoD  did  not  revise  its  strategy  for 
meeting  FDCCI  and  DoD  data  center  consolidation 
requirements  in  response  to  the  considerable 
increase  in  the  number  of  DoD  data  centers. 
According  to  DoD  CIO  officials,  the  large  number 
p  y 

and  contributed  to  DoD’s  inability  to  meet  the  FDCCI 
requirement.  Additionally,  the  officials  stated  that 
SPPNs  would  prevent  DoD  from  reaching  its  60-percent 
data  center  reduction  goal.16  Specifically,  of  the  1,663  data 
centers  not  scheduled  to  close  by  FY  2018,  1,096  (67  percent)  are  SPPNs. 


DoD  did  not 
revise  its  strategy 
for  meeting  FDCCI 
and  DoD  data  center 
consolidation  requirements 
in  response  to  the 
considerable  increase  in 
the  number  of  DoD 
data  centers. 


In  addition  to  not  revising  the  strategy  after  OMB  revised  the  data  center 
definition,  DoD  did  not  include  a  process  in  its  2011  data  center  consolidation 
plan  for  effectively  monitoring  Components'  progress  toward  meeting  data 
center  consolidation  goals.  For  example,  as  Components  changed  consolidation 


15  772  represents  the  number  of  data  centers  DoD  managed  in  FY  2010. 

16  SPPNs  are  data  centers  that  are  associated  with  infrastructure  or  equipment,  such  as  simulators  and  training  devices, 
which  cannot  be  consolidated. 
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information  in  DCIM,  the  DoD  CIO  did  not  confirm  whether  those  changes 
would  impact  DoD's  progress  toward  data  center  consolidation  goals.  Of  the 
119  data  centers  we  reviewed,  data  center  owners  changed  closure  dates  for 
19  data  centers.  However,  the  DoD  CIO  did  not  have  a  process  in  place  for 
addressing  changes  in  consolidation  status. 

DoD  CIO  Did  Not  Enforce  DoD  Consolidation  Requirement 

The  DoD  CIO  did  not  enforce  compliance  with  the  DoD  requirement  regarding  IPNs. 
According  to  a  DoD  CIO  memorandum,17  DoD  installations  should  not  have  more 
than  one  IPN.  As  of  September  30,  2015,  DCIM  had  54  installations  with  more  than 
one  IPN.  Specifically: 

•  2  installations  maintained  four  IPNs  each; 

•  10  installations  maintained  three  IPNs  each;  and 

•  42  installations  maintained  two  IPNs  each.18 

When  different  Components  located  on  the  same  installation  own  multiple  IPNs, 
the  DoD  CIO  requires  the  installation’s  executive  agent  to  lead  the  selection  of  a 
single  IPN  to  serve  the  installation.  If  Components  cannot  reach  an  agreement,  the 
DoD  CIO  will  select  the  IPN  for  the  installation.  However,  some  DoD  installations, 
such  as  Fort  Belvoir,  Virginia,  with  four  IPNs,  were  still  waiting  for  the  DoD  CIO  to 
determine  which  Component  would  maintain  the  single  IPN. 

Footprint  Reduction  and  Cost  Savings  Not  Achieved 

Because  DoD  did  not  reduce  the  number  of  data  centers  by  40  percent,  DoD  could 
not  reduce  its  energy  and  real  estate  footprint  or  achieve  the  cost  savings  as 
outlined  in  the  FDCCI.  Specifically,  DoD  could  not  determine  whether  it  achieved 
the  $680  million  cost  savings  by  FY  2015  as  initially  planned  because  it  could  not 
calculate  efficiencies  or  cost  savings  related  to  the  data  center  consolidation.  In 
addition,  DoD  might  not  reach  its  goal  to  reduce  the  number  of  data  centers  by 
60  percent  by  yearend  FY  2018  if  it  does  not  actively  monitor  consolidation  efforts 
and  enforce  compliance  with  requirements  for  data  center  consolidation.  Table  2 
shows  the  number  of  data  centers  DoD  plans  to  close  from  FY  2016  through 
FY  2018.  Even  with  the  additional  planned  closures,  DoD  will  not  meet  its  data 
center  reduction  goals. 


17  DoD  CIO  Memorandum,  "Department  of  Defense  Joint  Information  Environment:  Continental  United  States  Core  Data 
Center  and  Application  and  System  Migration,"  July  11,  2013. 

18  See  Appendix  B  for  a  list  of  installations  with  multiple  IPNs. 
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Table  2.  DoD  Data  Center  Consolidation  Plans  From  FY 2016  Through  FY 2018 


Component 

Number  of 
Data  Centers  as 
of  FY  2015 

Number  of  Data 
Centers  Closed 
as  of  FY  2015 

Additional  Data 
Centers  to  Close 
by  FY  2018 

Total  Percentage 
of  Data  Centers 
Closed  by  FY  20181 

Army 

1,162 

352 

140 

42 

Marine  Corps 

90 

11 

17 

31 

Navy 

307 

47 

67 

37 

Air  Force 

1,088 

69 

519 

54 

DISA 

24 

7 

1 

33 

All  Other  DoD 
Components 

444 

82 

52 

30 

Total 

3,115 

5682 

796 

44 

1  Numbers  are  rounded  to  the  next  whole  number  after  0.5  to  improve  readability. 

2  This  figure  reflects  data  centers  that  actually  closed  per  DCIM.  It  does  not  include  84  data  centers 
that,  according  to  DCIM,  had  not  closed  as  planned  by  yearend  of  FY  2015. 


Management  Comments  on  the  Finding  and 
Our  Response 

Defense  Information  Systems  Agency  Comments 

The  DISA  CIO  stated  that  DISA  does  not  agree  with  OMB’s  definition  of  a  data 
center  because  it  is  too  broad  and  includes  any  facility  with  a  closet,  room,  floor, 
or  building  required  to  enable  workstations  or  extend  network  connectivity.  He 
requested  that  the  report  highlight  the  data  center  definition  as  a  DoD  challenge 
instead  of  highlighting  non-compliance  "for  a  standard  that  was  not  defined 
properly  and  is  commercially  and  governmentally  unacceptable."  The  DISA  CIO  also 
recommended  that  the  DoD  Office  of  Inspector  General  work  with  subject  matter 
experts  to  rewrite  the  data  center  definition  to  ensure  that  Components  could 
execute  the  intent  of  the  law  and  effectively  measure  efficiencies. 

Our  Response 

We  acknowledge  that  the  revised  data  center  definition  includes  a  broad  range  of 
facilities,  spaces,  and  equipment  and  that  the  revision  was  one  of  the  reasons  DoD 
did  not  comply  with  the  FDCCI.  However,  the  DoD  CIO  directed  DoD  Components, 
including  DISA,  to  implement  plans  to  meet  the  FDCCI  requirements  based  on 
the  revised  definition.  OMB  developed  the  data  center  definition  (original  and 
revised),  which  applies  to  all  Federal  Government  agencies.  Although  the  DISA  CIO 
recommended  that  we  work  to  rewrite  the  data  center  definition,  the  responsibility 
to  develop  policy  for  Federal  agencies  resides  with  the  OMB  regarding  this  matter, 
not  DoD  OIG. 
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Department  of  the  Navy  Comments 

The  Acting  DON  CIO  stated  that  the  report  did  not  address  the  FDCCI  original 
goal  of  closing  800  data  centers  across  the  entire  Federal  Government  in 
2011  or  identify  the  portion  of  that  goal  attributable  to  DoD.  In  addition, 
the  Acting  DON  CIO  stated  that  DoD’s  closure  of  568  data  centers  by 
September  30,  2015,  and  the  planned  closures  of  an  additional  796  data  centers  by 
yearend  FY  2018  should  have  been  acknowledged  as  a  contribution  toward  FDCCI’s 
original  goal  of  closing  800  data  centers. 

The  Acting  DON  CIO  also  stated  that  the  report  did  not  give  the  Navy  and 
Marine  Corps  credit  for  reducing  their  number  of  data  centers  prior  to  FDCCI 
through  theater  transformations,  base  realignments,  base  closures,  and  data 
center  downsizing  and  decommissioning.  As  a  direct  result  of  these  efforts,  the 
Acting  DON  CIO  stated  that  the  Navy  and  Marine  Corps  now  own  only  13  percent  of 
the  total  number  of  data  centers  across  DoD  despite  being  about  30  percent  of  the 
total  its  force  structure.  As  such,  the  Acting  DON  CIO  stated  that  the  Navy  should 
not  have  been  required  to  meet  the  same  40-percent  goal  as  the  other  Services. 

Our  Response 

OMB  originally  established  a  goal  of  reducing  the  number  of  data  centers  by 
40  percent  by  closing  800  data  centers  across  the  Federal  Government  by 
yearend  FY  2015.  However,  that  goal  did  not  include  a  specific  number  of  data 
centers  attributable  to  DoD.  In  2012,  OMB  revised  the  data  center  definition  to 
include  smaller  facilities.  The  revised  definition  did  not  result  in  a  change  to  the 
40  percent  reduction  goal,  but  changed  the  original  goal  of  800  planned  closures. 
The  DoD  CIO  issued  the  Data  Center  Reference  Architecture  defining  DoD’s 
expectations  for  closing  data  centers  after  OMB  revised  its  data  center  definition. 
The  Data  Center  Reference  Architecture  states  the  revised  data  center  definition 
caused  the  number  of  data  centers  managed  by  DoD  to  increase  to  more  than  1,000 
from  the  original  count  of  772.  As  previously  reported  and  acknowledged  by  the 
Acting  DON  CIO,  DoD  closed  568  data  centers  by  yearend  FY  2015  and  planned 
to  close  at  least  796  additional  facilities  between  FY  2016  and  yearend  FY  2018. 

Of  those  closures,  the  Navy  closed  about  15  percent  and  the  Marine  Corps  closed 
about  12  percent  of  their  respective  data  centers.  The  Navy  and  Marine  Corps’ 
data  center  closures  did  not  meet  DoD’s  40  percent  reduction  goal  expected  for 
each  Component. 

We  commend  the  Navy  and  Marine  Corps  for  proactively  reducing  their  number  of 
data  centers  before  2010;  however,  DoD  did  not  include  and  report  those  closures 
as  part  of  its  efforts  to  meet  the  FDCCI  goals.  As  such,  we  reported  only  on  the 
number  of  data  centers  closed  between  FY  2010  and  FY  2015. 
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Recommendations,  Management  Comments,  and 
Our  Response 

Recommendation  A 

We  recommend  the  Chief  Information  Officer,  DoD: 

1.  Revise  DoD’s  strategy  for  data  center  consolidation  to  account  for 
the  significant  increase  in  the  number  of  data  centers.  The  revised 
strategy  should  also  include  a  process  for  addressing  changes  in 
consolidation  status  that  would  impact  DoD's  progress  toward 
meeting  data  center  consolidation  requirements. 

DoD  Chief  Information  Officer  Comments 

The  DoD  CIO  agreed  stating  that  he  is  taking  steps  to  revise  the  DoD  strategy  for 
data  center  consolidation,  which  should  be  completed  by  yearend  FY  2016.  He 
stated  that  DoD  is  integrating  its  approach  for  data  center  consolidation  and  cloud 
computing  into  a  single  "compute  and  storage  strategy."  The  DoD  CIO  stated  this 
approach  would  revise  the  DoD  data  center  consolidation  strategy  to  account 
for  the  increase  in  the  number  data  centers.  The  DoD  CIO  also  stated  that  DoD 
was  seeking  relief  from  OMB  to  exclude  SPPNs  from  its  data  center  consolidation 
metrics  because  SPPNs  could  not  be  severed  from  the  facilities  or  equipment 
they  supported. 

Our  Response 

Comments  from  the  DoD  CIO  addressed  all  specifics  of  the  recommendations  and 
no  further  comments  are  required. 

2.  Perform  a  review  of  installations  with  multiple  Installation 
Processing  Nodes  and  work  with  executive  agents  at  installations  to 
select  a  single  Installation  Processing  Node. 

DoD  Chief  Information  Officer  Comments 

The  DoD  CIO  neither  agreed  nor  disagreed  with  the  recommendation.  He  stated 
however,  that  he  planned  to  work  with  the  Services  to  reconcile  instances  of 
multiple  IPNs  on  individual  bases.  The  DoD  CIO  added  that  DoD  has  until  yearend 
FY  2018  to  complete  these  actions  and  therefore,  DoD  was  not  delinquent  on 
meeting  the  requirement. 
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Our  Response 

We  disagree  that  DoD  has  until  yearend  FY  2018  to  reconcile  instances  of  multiple 
IPNs  on  individual  bases.  DoD  CIO  Memorandum,  "DoD  Component  Data  Center 
Consolidation  Implementation  Plans,”  July  11,  2013,  which  directs  a  single  IPN  per 
individual  base,  does  not  contain  a  suspense  date  to  complete  the  requirement. 
However,  DoD  CIO  planned  actions  to  work  with  the  Services  to  reconcile  instances 
of  multiple  IPNs  meet  all  specifics  of  the  recommendation  and  no  further  comments 
are  required. 
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DoD  Components  Did  Not  Report  Accurate  Data 
Center  Information 

DoD  Components  did  not  accurately  report  data  center  information  to  the  DoD  CIO. 
Specifically,  DCIM  information  was  not  accurate  for  68  of  the  119  data  centers 
we  reviewed.  This  occurred  because  the  DoD  CIO  did  not  issue  clear  guidance  on 
recording  and  updating  DCIM  data.  In  addition,  the  DoD  CIO  and  Component  CIOs 
did  not  implement  an  effective  process  to  validate  DCIM  accuracy.  As  a  result,  DoD 
reported  inaccurate  information  on  its  data  center  consolidation  progress  to  OMB 
and  other  stakeholders.  Inaccurate  reporting  increases  the  risk  of  inappropriately 
assessing  DoD’s  cost  savings  and  efficiencies  gained  through  consolidation  efforts. 


DCIM  Information  Was  Not  Accurate 

DoD  Components  did  not  accurately  report  data  center 
information  to  the  DoD  CIO.  According  to  a  DoD  CIO 
memorandum,19  Components  were  required  to  input  data 
center  inventory  and  consolidation  milestones  in  DCIM  by 
April  30,  2015.  As  of  April  30,  2015,  the  DoD  CIO  considered 
DCIM  data  valid  and  used  it  to  report  closures,  operating 
costs,  and  other  metrics  to  DoD  and  OMB.  However,  of  the 
119  data  centers  we  reviewed,  DCIM  information  was  not 
accurate  for  68.  Specifically, 

•  Of  the  42  Army  data  centers  we  reviewed,  24  did  not  accurately  report 
closure  status,  server  count,  or  personnel  information  in  DCIM.  For 
example,  Aberdeen  Proving  Ground,  Maryland,  closed  one  of  its  data 
centers  in  May  2015.  However,  DCIM  was  not  updated  to  reflect  the 
closure  and  still  indicated  that  the  data  center  would  close  in  the  first 
quarter  of  FY  2017. 

•  Of  the  33  Marine  Corps  data  centers  we  reviewed,  19  did  not  accurately 
report  closure  status,  server  count,  or  personnel  information  in  DCIM. 

For  example,  DCIM  showed  110  personnel  supporting  a  Camp  Pendleton, 
California,  data  center.  However,  the  data  center  owner  stated  that,  based 
on  the  number  of  personnel  hours  reported,  only  about  60  personnel 
supported  the  data  center. 


Of  the  119 
data  centers  we 
reviewed,  DCIM 
information  was 
not  accurate 
for  68. 


19  DoD  CIO  Memorandum,  "Changes  in  DoD  Data  Center  Inventory  and  Consolidation  Implementation  Plan  Reporting 
Requirements,"  March  31,  2015. 
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•  Of  the  40  Navy  data  centers  we  reviewed,  23  did  not  accurately  report 
closure  status,  server  count,  personnel,  or  data  center  designation 
information  in  DCIM.  For  example,  Department  of  the  Navy’s  Space  and 
Naval  Warfare  Systems  Command,  California,  reported  565  operating 
systems  and  565  virtual  operating  systems  in  DCIM.  However,  the  data 
center  owner  could  provide  evidence  supporting  the  existence  of  only 
20  operating  systems20  and  1  virtual  operating  system.21 

•  Of  the  four  DISA  data  centers  we  reviewed,  two  did  not  accurately 
report  server  count  information  in  DCIM.  Specifically,  we  identified 
two  data  centers  that  DISA  did  not  report  to  the  DoD  CIO:  one  in 
Chambersburg,  Pennsylvania,  and  one  at  Scott  Air  Force  Base,  Illinois. 

The  DISA  Continental  U.S.  Deputy  Commander  acknowledged  they  did 
not  accurately  report  data  center  activity  because  they  did  not  fully 
understand  the  original  definition  of  a  data  center.  After  providing  the 
Deputy  Commander  the  revised  data  center  definition,  he  acknowledged 
that  the  site  was  a  data  center.  In  addition,  the  Defense  Information 
Technology  Contracting  Organization  reported  a  data  center  as  closed 
with  no  inventory  in  DCIM.  However,  the  data  center  was  still  operating 
and  DISA  had  no  immediate  plans  to  close  it. 

We  did  not  include  the  Air  Force  in  our  sample  because  an  Air  Force  CIO  official 
acknowledged  the  Air  Force  severely  underreported  data  center  information  in 
DCIM.  For  example,  on  May  28,  2015,  the  Air  Force  reported  563  data  centers  in 
DCIM.  By  September  30,  2015,  that  number  had  almost  doubled  to  1,088. 

DCIM  Guidance  Was  Not  Clear 

The  DoD  CIO  did  not  issue  clear  guidance  to  DoD  Components  on  recording 
and  updating  data  center  information  in  DCIM.  Instead,  the  DoD  CIO  relied  on 
Component  CIOs  to  communicate  data  center  consolidation  requirements  discussed 
during  working  group  meetings  to  data  center  owners  and  did  not  revise  existing 
DoD  CIO  policy.  Although  data  center  owners  visited  were  aware  of  the  data 
center  consolidation  initiative,  they  were  not  always  aware  of  the  DCIM  reporting 
requirements.  Data  center  owners  were  not  provided  clear  instructions  to  report 
data  center  information  to  Component  CIOs.  Because  the  DoD  CIO  used  DCIM  data 
to  update  OMB  and  other  stakeholders  on  DoD's  data  center  consolidation  progress, 
data  center  owners  needed  clear  guidance  for  reporting  accurate  and  complete  data 
center  information  to  Component  CIOs. 


20  An  operating  system  is  the  software  that  controls  the  execution  of  other  computer  programs,  schedules  tasks,  allocates 
storage,  manages  the  interface  to  peripheral  hardware,  and  presents  a  default  interface  to  the  user  when  no  application 
program  is  running. 

21  An  operating  system  that  hosts  other  operating  systems. 
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Effective  Validation  Process  Needed 

The  DoD  and  Component  CIOs  did  not  implement  an  effective  process  to  validate 
the  accuracy  of  DCIM  data.  Instead,  according  to  the  DoD  CIO  data  center 
consolidation  lead,  the  DoD  CIO  relied  on  Component  CIOs  to  ensure  data  center 
information  was  accurate  in  DCIM.  The  Component  CIOs  then  relied  on  data 
center  owners  to  submit  accurate  data  center  information.  According  to  the 
DoD  CIO  memorandum,22  Components  were  required  to  ensure  the  accuracy  and 
completeness  of  data  center  inventory  in  the  DCIM  system  by  April  30,  2015. 

After  this  date,  the  DoD  CIO  considered  the  data  in  DCIM  valid.  However, 
the  DoD  CIO  did  not  perform  steps  to  validate  data  center  information  before 
accepting  the  DCIM  data  as  valid  or  establish  a  process  to  periodically  validate 
the  data.  Consequently,  the  information  reported  to  OMB  and  other  stakeholders 
was  inaccurate. 

Consolidation  Reporting  Was  Not  Accurate 

The  DoD  CIO  used  DCIM  to  report  data  center  closures  to  OMB.  The  information 
was  used  to  calculate  the  total  cost  of  owning  data  centers  and  to  make  critical 
funding  decisions  related  to  DoD’s  IT  infrastructure.  The  reporting  of  inaccurate 
and  incomplete  DCIM  data  increases  the  risk  that  Congress  and  other  stakeholders 
could  inappropriately  assess  the  Department’s  cost  savings  and  efficiencies  gained 
through  consolidating  data  centers. 

Recommendations,  Management  Comments,  and 
Our  Response 

Redirected  Recommendation 

As  a  result  of  management  comments,  we  redirected  Recommendation  B.2  to  the 
Department  of  the  Navy  CIO  because  the  CIO  has  the  authority  to  implement  the 
recommendation  for  Deputy  CIO-Navy  and  Deputy  CIO-Marine  Corps  actions. 

Recommendation  B.l 

We  recommend  the  Chief  Information  Officer,  DoD: 

a.  Develop  and  issue  comprehensive  guidance  for  accurately  reporting 
data  center  information  in  the  Data  Center  Inventory  Management  to 
DoD  Components. 

b.  Develop  a  process  for  validating  the  accuracy  and  completeness  of 
information  in  the  Data  Center  Inventory  Management  system. 


22  DoD  CIO  Memorandum,  "Changes  in  DoD  Data  Center  Inventory  and  Consolidation  Implementation  Plan  Reporting 
Requirements/'  March  31,  2015. 
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DoD  Chief  Information  Officer  Comments 

The  DoD  CIO  neither  agreed  nor  disagreed  with  the  recommendation.  He  stated 
however,  that  he  was  analyzing  existing  policies  and  guidance  and  would  enhance 
them  as  necessary  by  yearend  FY  2016.  The  DoD  CIO  also  stated  he  was  working 
with  the  Components  to  improve  processes  for  validating  the  accuracy  of  data 
center  inventory  reported  to  OMB.  The  DoD  CIO  expected  to  complete  these 
actions  by  the  second  quarter  of  FY  2017. 

Our  Response 

Comments  from  the  DoD  CIO  addressed  all  specifics  of  the  recommendation  and  no 
further  comments  are  required. 

Recommendation  B.2 

We  recommend  the  Chief  Information  Officer,  Department  of  the  Army; 
Department  of  the  Navy  Chief  Information  Officer;  Chief  Information  Officer, 
Office  of  the  Secretary  of  the  Air  Force;  and  Chief  Information  Officer, 

Defense  Information  Systems  Agency  revise  their  current  processes  for 
validating  data  center  information  to  ensure  the  accuracy  and  completeness 
of  information  reported  to  the  DoD  Chief  Information  Officer. 

Department  of  the  Army  Deputy  Chief  Information  Officer  Comments 
The  Army  Deputy  CIO,  responding  for  the  Army  CIO,  agreed  stating  the  Army 
would  continue  to  work  with  the  DoD  CIO  to  address  data  center  deficiencies  and  to 
update  DCIM.  However,  he  stated  that  there  will  always  be  a  "lag"  in  DCIM  updates 
once  a  data  center  is  closed  because  DCIM  is  updated  only  after  the  Army  CIO 
receives  a  signed  closure  report  from  a  general  officer  or  senior  executive.  The 
Army  Deputy  CIO  requested  that  the  DoD  Office  of  Inspector  General  provide 
the  Army  CIO  with  the  identification  numbers  for  the  Aberdeen  Proving  Ground, 
Maryland,  data  centers  to  determine  the  discrepancies  in  DCIM.  In  addition,  the 
Army  Deputy  CIO  requested  we  change  Fort  Belvoir,  Maryland  in  Appendix  B  to 
Fort  Belvoir,  Virginia. 

Our  Response 

We  acknowledge  delays  occurred  between  the  time  the  Army  closed  data  centers 
and  when  DCIM  was  updated.  We  will  provide  the  Army  CIO  the  identification 
numbers  for  the  24  data  centers  that  did  not  accurately  report  closure  status, 
server  count,  or  personnel  information  in  DCIM  to  review  for  correction.  In 
addition,  we  changed  Appendix  B  to  show  Fort  Belvoir,  Virginia  instead  of  Fort 
Belvoir,  Maryland.  Comments  from  the  Deputy  CIO  addressed  all  specifics  of  the 
recommendation  and  no  further  comments  are  required. 
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Department  of  the  Navy  Chief  Information  Officer  Comments 
The  Acting  DON  CIO  agreed  stating  that  she  issued  updated  policy  regarding 
data  center  fund  obligations  in  Memorandum  "Approvals/Waivers  for  Obligation 
of  Funds  for  Data  Servers  and  Centers,"  September  1,  2015.  The  policy  stops 
DON  activities  from  initiating  IT  procurement  actions  for  data  centers  unless  the 
DON  CIO  verifies  that  data  center  information  is  accurately  and  fully  reported 
to  the  DoD  CIO.  The  Acting  DON  CIO  also  stated  that  she  would  work  with  the 
DON  Deputy  CIO-Navy  and  DON  Deputy  CIO-Marine  Corps  to  implement  additional 
internal  verification  processes,  to  include  initiating  data  center  discovery  and 
reporting,  to  improve  the  accuracy  and  completeness  of  Navy  and  Marine  Corps 
data  center  information  reported  to  the  DoD  CIO. 

Our  Response 

Comments  from  the  DON  CIO  addressed  all  specifics  of  the  recommendation  and  no 
further  comments  are  required. 

Air  Force  Chief  Information  Officer  Comments 

The  Chief,  Air  Force  Information  Dominance  and  CIO  neither  agreed  nor  disagreed 
with  the  recommendation.  He  stated  however,  that  the  Air  Force  issued  the 
following  three  memorandums  to  improve  the  accuracy  and  completeness  of  data 
reported  to  the  DoD  CIO. 

•  Data  Center  Consolidation  Strategic  Communication,  July  16,  2015.  The 

Air  Force  outlined  its  way  forward  in  consolidating  data  centers  including 
updating  DCIM,  consolidating  to  a  single  IPN,  and  verifying  the  accuracy  of 
closure  dates  in  DCIM. 

•  Data  Center  Inventory  Management  (DCIM)  Data  Cleanup,  August  18,  2015. 
The  Air  Force  required  all  data  center  owners  to  register  in  DCIM  within 
60  days  of  the  memorandum’s  issuance  otherwise  the  CIO  would  block  or 
deny  future  funding;  and  review  and  verify  data  center  information  every 
6  months  and  report  required  changes. 

•  Obligation  of  Funds  for  Data  Centers  and  Servers,  January  20,  2016.  The 
Air  Force  reminded  contracting  officers  and  Program  Executive  Officers 
of  existing  guidance  on  the  obligation  approval  process  and  warned  that 
contracting  actions  acquiring  items  without  CIO  approval,  to  include 
acquisitions  related  to  data  center  inventory,  would  be  stopped. 

Our  Response 

Although  the  Air  Force  CIO  neither  agreed  nor  disagreed  with  the  recommendation, 
actions  taken  met  the  intent  of  the  recommendation.  Therefore,  no  further 
comments  are  required. 
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Defense  Information  Systems  Agency  Chief  Information  Officer  Comments 

The  DISA  CIO  partially  agreed,  stating  that  DISA  would  provide  clear  guidance 
for  DCIM  and  data  center  reporting  requirements  by  developing  instructions 
and  issuing  articles  to  help  disseminate  information  across  the  agency.  The 
DISA  CIO  also  stated  that  each  data  center  owner  would  be  required  to  identify 
a  point  of  contact  to  ensure,  on  a  semiannual  basis,  that  information  in  the 
DCIM  system  was  valid  and  accurate.  In  addition,  he  stated  that  DISA  would 
continue  to  issue  data  center  validation  reports  and  monitor  compliance  during 
annual  spot  checks  of  all  DISA  facilities.  The  DISA  CIO  stated  that  DISA  plans  to 
complete  these  process  revisions  no  later  than  fourth  quarter  FY  2016.  Further, 
the  DISA  CIO  stated  that  DISA  does  not  consider  the  facilities  in  Chambersburg 
and  Scott  Air  Force  Base  to  be  data  centers  because  they  are  operational  units 
conducting  cybersecurity  missions. 

Our  Response 

Although  the  DISA  CIO  partially  agreed  with  the  recommendation,  actions  taken  to 
provide  clear  guidance  for  DCIM  and  data  center  reporting  requirements  addressed 
the  intent  of  the  recommendation.  However,  we  disagree  that  the  facilities  in 
Chambersburg  and  Scott  Air  Force  Base  (DISA  Continental  United  States)  are  not 
data  centers.  The  equipment  and  infrastructure  at  these  facilities  met  OMB’s 
revised  data  center  definition.  For  example,  the  facility  in  Chambersburg  had 
29  servers,  seven  of  which  supported  the  local  area  network  in  the  same  facility, 
while  the  facility  in  Scott  Air  Force  Base  had  70  physical  servers  and  30  virtual 
servers.  While  onsite  at  Scott  Air  Force  Base,  the  Deputy  Commander,  DISA 
Continental  United  States,  acknowledged  his  facility  was  a  data  center  based  on 
OMB’s  revised  data  center  definition.  The  OMB  revised  definition  does  not  include 
"mission”  as  a  factor  in  determining  whether  a  facility  is,  or  is  not,  a  data  center. 
Therefore,  the  DISA  CIO  should  report  the  Chambersburg  and  Scott  Air  Force  Base 
facilities  as  data  centers  in  DCIM.  We  request  that  the  DISA  CIO  reconsider  his 
position  and  designate  the  facilities  as  data  centers  and  ensure  that  DCIM  is 
updated  accordingly.  We  request  that  the  DISA  CIO  provide  additional  comments 
on  the  final  report  on  his  plan  to  report  these  data  centers  to  the  DoD  CIO. 
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Appendix  A 

Scope  and  Methodology 

We  conducted  this  performance  audit  from  March  2015  through  January  2016 
in  accordance  with  generally  accepted  government  auditing  standards.  Those 
standards  require  that  we  plan  and  perform  the  audit  to  obtain  sufficient, 
appropriate  evidence  to  provide  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objectives.  We  believe  that  the  evidence  obtained  provides  a 
reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 

To  understand  the  Department’s  progress  in  consolidating  data  centers,  we 
interviewed  officials  from  the: 

•  DoD  CIO; 

•  Department  of  the  Army  CIO; 

•  Marine  Corps  Command,  Control,  Communications,  and  Computers 
Department; 

•  Department  of  the  Navy  CIO; 

•  Secretary  of  the  Air  Force  Information  Dominance  and  CIO;  and 

•  DISA  CIO. 

We  reviewed  Federal  laws  and  Department  policy,  including  DoD  CIO  guidance  and 
Military  Service  guidance.  We  selected  a  nonstatistical  sample  of  132  of  1,497  data 
centers  owned  by  the  Army,  Marine  Corps,  and  Navy.23  We  reviewed  the  status  of 
115  of  the  132  data  centers  from  February  2010  through  September  2015  (we  did 
not  review  17  Army  data  centers  because  there  was  sufficient  evidence  to  support 
the  finding).  In  addition,  we  identified  four  data  centers  owned  by  DISA  that  were 
not  recorded  or  updated  in  DCIM,  and  reviewed  the  status  of  those  data  centers. 

As  a  result,  we  reviewed  119  data  centers  at  the  following  DoD  installations: 

•  Aberdeen  Proving  Ground,  Maryland 

•  Naval  Air  Station  North  Island,  California 

•  Naval  Base  Point  Loma,  California 

•  Naval  Base  San  Diego,  California 

•  Naval  Base  Coronado,  California 

•  Naval  Outlying  Landing  Field  Imperial  Beach,  California 

•  Marine  Corps  Base  Quantico,  Virginia 

•  Marine  Corps  Base  Camp  Pendleton,  California 


23  We  did  not  include  the  Air  Force  in  the  sample  because  an  Air  Force  CIO  official  acknowledged  the  Air  Force  severely 
underreported  the  number  of  data  centers  the  Air  Force  owns  and  operates. 
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•  Marine  Corps  Air  Station  Miramar,  California 

•  DISA  Risk  Management  Executive  and  Implementation  and  Sustainment 
Center,  Chambersburg,  Pennsylvania 

•  DISA  Continental  U.S.  and  Defense  Information  Technology  Contracting 
Organization,  Scott  Air  Force  Base,  Illinois 

We  interviewed  data  center  owners  at  each  site  to  determine  the  status  of  data 
center  consolidation  from  February  2010  through  September  2015.  We  also 
reviewed  lists  of  data  center  inventory,  approval  documentation  for  data  center 
designation,  and  other  supporting  documentation  on  efforts  toward  data  center 
consolidation.  Furthermore,  we  compared  the  status  of  data  center  consolidation 
and  the  inventory  lists  to  determine  the  accuracy  and  completeness  of  DCIM 

Use  of  Computer-Processed  Data 

We  used  computer-processed  data  from  DCIM,  which  the  DoD  CIO  used  to  track 
DoD  data  centers  and  their  consolidation  status,  including  personnel,  closure  status, 
implementation  dates,  and  IT  inventory.  DCIM  data  were  extracted  as  Microsoft 
Excel  spreadsheets  that  included  consolidation  data  and  physical  locations  of  the 
data  centers.  We  used  DCIM  data  to  obtain  a  universe  of  data  centers  managed  by 
DoD,  data  center  designations,  consolidation  status,  and  IT  inventory.  To  assess 
the  reliability  of  DCIM  data,  we  selected  a  sample  of  data  centers  and  compared 
the  DCIM  data  to  information  obtained  from  data  center  owners  and  from 
physical  inspections. 

We  also  used  information  reported  in  the  Army  Data  Center  Consolidation 
Plan  (ADCCP)  tracking  tool,  which  the  Army  CIO  used  to  capture  data  center 
consolidation  information  such  as  data  center  name,  location,  DoD  ID  number,  data 
center  description,  closure  information,  challenges,  and  IT  inventory.  The  Army  CIO 
used  the  ADCCP  data  to  update  DCIM.  We  used  ADCCP  data  to  understand  the 
data  center  mission,  purpose,  and  data  center  designation.  We  compared  data  in 
ADCCP  to  data  recorded  in  DCIM  to  identify  discrepancies  in  data  center  records. 

To  assess  the  reliability  of  ADCCP  data,  we  compared  information  obtained  from 
interviews  with  Army  data  center  owners  and  from  inspections  of  DCIM  data. 

Information  in  DCIM  and  ADCCP  was  not  sufficiently  reliable  to  determine  the 
status  of  DoD’s  data  center  consolidation.  Specifically,  personnel  from  the  DoD 
CIO  and  Component  CIOs  informed  us  that  the  DCIM  universe  was  not  accurate.  In 
addition,  data  center  designations,  closure  status,  and  data  center  IT  inventory  did 
not  always  match  information  provided  by  data  center  owners.  As  reported  in  our 
findings,  we  used  the  information  to  generate  a  sample  of  data  centers  to  visit  and 
developed  recommendations  for  implementing  controls  to  validate  the  accuracy  and 
validity  of  DCIM  data. 


DODIG-2016-068  |  19 


Appendixes 


Use  of  Technical  Assistance 

The  DoD  OIG  Quantitative  Methods  Division  assisted  with  the  nonstatistical 
sampling  method  that  we  used  to  select  the  data  centers  to  visit. 

Prior  Coverage 

During  the  last  5  years,  the  Government  Accountability  Office  (GAO)  and 
the  Army  Audit  Agency  issued  nine  reports  related  to  DoD's  efforts  to 
consolidate  data  centers.  Unrestricted  GAO  reports  can  be  accessed  at 
http://www.gao.gov  and  unrestricted  Army  Audit  Agency  reports  can  be 
accessed  at  http://www.aaa.army.mil. 

GAO 

Report  No.  GAO-15-296,  "Information  Technology:  Additional  OMB  and  Agency 
Actions  Needed  to  Ensure  Portfolio  Savings  Are  Realized  and  Effectively  Tracked,” 
April  16,  2015 

Report  No.  GAO-14-713,  "Data  Center  Consolidation:  Reporting  Can  Be  Improved  to 
Reflect  Substantial  Planned  Savings,"  September  25,  2014 

Report  No.  GAO-13-627T,  "Data  Center  Consolidation:  Strengthened  Oversight 
Needed  to  Achieve  Billions  of  Dollars  in  Savings,"  May  14,  2013 

Report  No.  GAO-13-378,  "Data  Center  Consolidation:  Strengthened  Oversight  Needed 
to  Achieve  Cost  Savings  Goal,"  April  23,  2013 

Report  No.  GAO-12-742,  "Data  Center  Consolidation:  Agencies  Making  Progress  on 
Efforts,  but  Inventories  and  Plans  Need  to  Be  Completed,"  July  19,  2012 

Report  No.  GAO-12-241,  "Information  Technology:  Departments  of  Defense  and 
Energy  Need  to  Address  Potentially  Duplicative  Investments,”  February  17,  2012 

Report  No.  GAO-11-565,  "Data  Center  Consolidation:  Agencies  Need  to  Complete 
Inventories  and  Plans  to  Achieve  Expected  Savings,”  July  19,  2011 

Army  Audit  Agency 

Report  No.  A-2013-0023-FMT,  "Audit  of  Army  Data  Center  Consolidation,” 

December  12,  2012 

Report  No.  A-2011-0143-IET,  "Application  Migration,”  July  6,  2011 
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Appendix  B 

List  of  Installations  With  Multiple  IPNs 


Although  the  DoD  CIO  issued  policy  stating  that  DoD  installations24  could  not  have 
more  than  one  IPN,  the  following  54  installations  maintained  multiple  IPNs. 

Table  3.  Installations  with  Multiple  IPNs 


Base  Location 

Number 
of  IPNs 

Base  Location 

Number 
of  IPNs 

Fort  Belvoir,  Virginia 

4 

Detroit  Arsenal,  Michigan 

2 

Andrews  Air  Force  Base  (AFB), 
Maryland 

4 

Port  Hueneme,  California 

2 

Rome,  New  York 

3 

Eielson  AFB,  Arkansas 

2 

Redstone  Arsenal,  Alabama 

3 

Little  Rock  AFB,  Arkansas 

2 

Naval  Air  Station  Joint  Reserve 

Base  New  Orleans,  Louisiana 

3 

Elmendorf  AFB,  Arkansas 

2 

Fort  Bragg,  North  Carolina 

3 

Marine  Corps  Base  Quantico,  Virginia 

2 

Warner  Robins  AFB,  Georgia 

3 

Fort  Benning,  Georgia 

2 

Fort  George  G.  Meade,  Maryland 

3 

Minot  AFB,  North  Dakota 

2 

Shaw  AFB,  South  Carolina 

3 

Fort  Buchanan,  Puerto  Rico 

2 

Fort  Sam  Houston,  Texas 

3 

Naval  Air  Weapons  Station  China 

Lake,  California 

2 

Minneapolis-St  Paul,  Minnesota 

3 

Fort  Huachuca,  Arizona 

2 

Louisville,  Kentucky 

3 

Niagara  Falls,  New  York 

2 

Naval  Support  Activity  Crane, 
Indiana 

2 

Fort  Leavenworth,  Kansas 

2 

McConnell  AFB,  Kansas 

2 

Naval  Station  Pearl  Harbor,  Hawaii 

2 

Rock  Island  Arsenal,  Illinois 

2 

Fort  Lee,  Virginia 

2 

Buckley  AFB,  Colorado 

2 

NSA  Philadelphia,  Pennsylvania 

2 

Naval  Base  Point  Loma,  California 

2 

Fort  Polk,  Louisiana 

2 

Charleston  AFB,  South  Carolina 

2 

Andersen  AFB,  Guam 

2 

Pentagon  Reservation,  Virginia 

2 

Fort  Worth,  Texas 

2 

Cheyenne,  Wyoming 

2 

Peterson  AFB,  Colorado 

2 

Maxwell  AFB,  Alabama 

2 

Homestead  Air  Reserve  Base,  Florida 

2 

Clay  Kaserne,  Germany 

2 

Red  River  Army  Depot,  Texas 

2 

24  For  the  purposes  of  this  report.  Base  Location  and  installation  mean  the  same  thing. 
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Table  3.  Installations  with  Multiple  IPNs  (cont'd) 


Base  Location 

Number 
of  IPNs 

Base  Location 

Number 
of  IPNs 

Naval  Air  Station 

Jacksonville,  Florida 

2 

Kirtland  AFB,  New  Mexico 

2 

Columbus,  Ohio 

2 

U.S.  Army  Kwajalein  Atoll, 

Marshall  Island 

2 

Naval  Station  Guantanamo  Bay, 

Cuba 

2 

Langley  AFB,  Virginia 

2 

Coraopolis,  Pennsylvania 

2 

March  AFB,  California 

2 

Offuttt  AFB,  Nebraska 

2 

Hanscom  AFB,  Massachusetts 

2 

The  DoD  CIO  memorandum25  requires  that  DoD  CIO  select  one  IPN  per  installation 
in  instances  where  different  Components  own  multiple  IPNs  and  cannot  reach 
an  agreement  on  a  single  IPN.  This  report  includes  a  recommendation  for  the 
DoD  CIO  to  review  installations  with  multiple  IPNs,  work  with  executive  agents 
at  installations  to  select  a  single  IPN,  and  facilitate  the  closure  of  additional  IPNs. 
(See  Finding  A} 


25  DoD  CIO  Memorandum,  “Department  of  Defense  Joint  Information  Environment:  Continental  United  States  Core 
Data  Center  and  Application  and  System  Migration,"  July  11,  2013. 
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Management  Comments 

DoD  Chief  Information  Officer  Comments  Reference 


CH^  INFORMATION  QFfTCEH 


DEPARTMENT  OF  DEFENSE 

6000  defense  pentagon 

WASHINGTON,  D,C-  20301-6000 


MEMORANDUM  FOR  INSPECTOR  GENERAL  OF  THE  DEPARTMENT  OF  DEFENSE 

SUBJECT ;  Draft  Rcpon  “DoD's  Efforts  to  Consolidate  Data  Centers  Need  Improvement” 
(Project  No,  D2015-DO0URC-01 37.000) 

Reference:  (a)  DoD  IG  Memorandum  Requesting  Department  of  Defense  Chief  Information 
Officer  (DoD  CIO)  Review  and  Comment  on  Draft  Report  ^DoD's  Efforts  to 
Consolidate  Data  Centers  Need  Improvement”  (Project  No,  D2Q15-DOOORC- 
013 7,000 >,  dated  January  29. 2016 

(b)  DoD  CIO  Memorandum,  "DoD  Component  Data  Center  Consolidation 
Implementation  Plans”  dated  July  i  1, 2013 


DoD  CIO  reviewed  the  DoD  IG  Draft  Report,  ”DoD's  Efforts  to  Consolidate  Data 
Centers  Need  Improvement”  (Project  No,  D2O1S-DO0ORC-0 137,000),  in  response  to  Reference 
(a).  Although  DoD  does  not  agree  with  every  aspect  of  the  report  findings,  DoD  does  agree 
more  aggressive  action  is  required  to  achieve  Data  Center  Consolidation  (DCC)  objectives  and 
accepts  the  DoD  IG  recommendations. 

In  response  to  Recommendation  A,l,  revise  strategy  far  data  center  consolidation  to 
account  for  significant  increase  in  the  number  of  data  centers,  DoD  CIO  is  taking  steps  to 
address  this,  For  instance,  the  Department  is  integrating  approaches  for  DCC  and  cloud 
computing  into  a  single  Compute  and  Storage  Strategy,  This  will  rev^e  the  DoD  DCC  Strategy 
to  account  for  the  increase  in  the  number  of  data  centers  (specifically  Special  Purpose  Processing 
Nodes  (SPPNs))  and  cloud  computing's  impact  on  those  numbers.  Additionally*  as  shared  with 
the  DoD  IG  audit  team.  DoD  CIO  is  seeking  relief  from  the  Office  o  f  Management  and  Budget 
(OMB)  for  the  inclusion  of  SPPNs  in  the  DCC  metrics;  SPPNs  are  largely  nan-severab!e  from 
the  facilities  or  equipment  they  support,  and  therefore,  present  very  limited  consolidation 
opportunity.  The  estimated  date  of  completion  for  this  revised  strategy  is  the  end  of  FY 1 6, 

In  response  to  Recommendation  A, 2*  perform  review  of  installations  with  multiple 
Installation  Processing  Nodes  (IPNs).  DoD  CIO  is  reviewing  and  working  directly  with  the 
Services  to  reconcile  the  instances  of  multiple  TPNs  on  individual  Bases/Post s/Cam ps/Stations. 

It  is  important  to  note,  according  to  Reference  (b),  the  suspense  for  Components  to  reconcile 
instances  of  multiple  IPNs  is  FY  18,  and  therefore,  is  not  delinquent.  Estimated  date  of 
completion  remains  FYI 8, 

In  response  to  Recommendation  B.l.a,  develop  comprehensive  guidance  for  accurately 
reporting  data  center  information  in  the  Data  Center  Inventory  Management  (DOM)  system, 
DoD  CIO  is  performing  an  analysis  of  existing  policies  and  guidance  and  will  enhance  them*  as 
necessary.  Estimated  date  of  completion  is  end  of  FYI  6. 
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In  response  to  Recommendation  B„l  .b,  develop  a  process  for  validating  the  accuracy  and 
completeness  of  information  in  DCIM,  DoD  CIO  is  working  with  Components  to  further  refine 
and  improve  the  processes  for  validating  and  ensuring  the  accuracy  of  data  center  inventory 
reported  to  OMB,  Estimated  date  of  completion  is  Q2FY17. 
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QUltl,  r.Mel  IflUinnfihrii* 


SAIS-AOC 


DEPARTMENT  OF  THE  ARMY 

OFFICE  OF  THE  SECRETARY  OF  THE  ARMY 
107  ARMY  PENTAGON 
WASHINGTON  DC  20310-0107 


MEMORANDUM  FOR  Department  of  Defense  Inspector  General,  4800  Mark  Center 
Drive,  Alexandria,  VA  22350-1500 

SUBJECT;  Department  of  Defense  Inspector  General  Draft  Report,  "DoD’s  Efforts  to 
Consolidate  Data  Centers  Need  Improvement,”  (Project  No.  D2O15-DOQ0RC-Q137.OGO} 


1 .  Reference:  Draft  Report,  Deparment  of  Defense  Inspector  General,  29  January 
2016,  subject:  DoD’s  Efforts  to  Consolidate  Data  Centers  Need  Improvement  (Project 
No.  D201 5-DQ0ORC-O1 37.000), 

2.  The  Army  Chief  Information  Officer/G-6  appreciates  the  opportunity  to  review  the 
Inspector  General's  draft  report  on  data  center  consolidation  The  Army  CIO/G-6 
concurs  with  comments,  which  are  enclosed, 


3.  The  Army  will  continue  to  work  with  the  DoD  CIO  to  correct  the  noted  deficiencies, 
including  accuracy  of  the  information  in  the  DoD  Data.  Center  Inventory  Management 
system 


Enel  GARY  C.  WANG 

Deputy  Chief  Information  Office r/G-6 
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DEPARTMENT  OF  THE  NAVY 

CHIEF  INFORMATION  OFFICER 
1C&0  NAVY  PENTAGON 
WASHINGTON,  UC  ZOMO-IOBG 


26  February  2016 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 


Subj:  RESPONSE  TO  DOD IG  DRAFT  REPORT,  *D0DTS  EFFORTS  TO  CONSOLIDATE 

DATA  CENTERS  NEED  IMPROVEMENT,”  (PROJECT  NO  D201 5TXK3  ORC-O 137.000) 

Ref  :  (a)  DoD  Inspector  General  (IG)  Memorandum,  "DoD's  Efforts  to  Consolidate  Data  Centers 
Need  Improvement"  of  January  29,  2016 

(b)  DON  Chief  Information  Officer  Memorandum,  “Approvals/Waivers  for  Obligation  of 
Funds  for  Data  Servers  arid  Centers,”  of  September  01,  2015 

Enel:  (I  J  DON  CIO  Comment  Matrix  for  Subject  Report 

Reference  (a)  requested  Department  of  the  Navy  Chief  Information  Officer  (DON  CIO) 
review  and  comment  on  recommendation  EL2  of  the  Department  of  Defense  Inspector  General 
(DoD  IG)  draft  report,  "DoD's  Efforts  to  Consolidate  Data  Centers  Need  Improvement  (Project 
NO.  D2G 1 5'DOOORC'Ol 37.000)/ 

The  DON  CIO  agrees  with  recommendation  B.2;  all  DoD  Components  should  revise  their 
current  processes  for  validating  data  center  information  to  ensure  the  accuracy  and  completeness 

of  information  reported  to  the  DoD  Chief  Information  Officer* 

DON  CIO  has  already  taken  action  to  support  the  recommendation,  including  reference  (b), 
which  established  updated  policy  for  approval  and  waivers  for  obligation  of  funds  for  data 
servers  and  centers  The  memorandum  provided  the  Navy  and  the  Marine  Corps  with  amplifying 
guidance,  standardized  forms,  designated  tools,  and  streamlined  processes  for  submitting  data 
server  arid  data  center  r  eluted  obligation  request;^  which  will  ensure  the  DON*s  continued  full 
compliance  with  Section  2867  of  the  FY 12  National  Defense  Authorization  Act 

DON  CIO  has  also  worked  with  the  DON  Deputy  CIO  Navy  (DDCtO  Navy)  and  DON 
Deputy  CIO  Marine  Corps  (DDCIO  Marine  Corps)  to  refine  the  Department's  Information 
Technology  Procurement  Request  (ITPR)  approval  processes  to  provide  greater  detail  on  all  IT 
related  expenditures,  DON  CIO  reviews  every  Navy  and  Marine  Corps  ITPR  that  is  associated 
with  a  data  server  or  data  center  obligation  during  the  NDAA  waiver  request  process  Policy, 
processes,  and  oversight  are  firmly  in  place  to  ensure  that  no  procurement  action  for  IT 
associated  with  a  data  server  or  data  center  is  initiated  within  the  DON  that  has  not  received  both 
an  ITPR  and  an  NDAA  waiver  approval,  which  includes  DON  CIO  verification  that  the  data 
center  facility  is  accurately  and  hilly  reported  to  DoD  CIO, 

DON  CIO  will  work  with  DDCIO  Navy  and  DDCIO  Marine  Corps  to  develop  and 
implement  additional  data  center  information  validation  methods,  including  conducting  more 
onsite  inspections  and  deploying  IT  Asset  Management  (IT AM)  data  discovery  and  reporting 
tools  as  they  become  available.  DON  CIO  will  also  continue  to  collaborate  with  DoD  CIO  on 
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Suhj:  NDA  A  WAIVER  APPROVAL  FOR  DATA  CENTER  PROCUREMENT  REQUESTS 


improvement  of  the  processes  and  tools  used  for  validating  and  ensuring  the  accuracy  and 
completeness  of  data  center  information  reported  by  the  Navy  and  Marine  Corps, 


Additional  comments  on  the  Do^^jrafUeporUin^rovided  in  Enclosure  { i j.  The  DON 
CIO  point  of  contact  for  this  audit  is who  may  he  reached  at 


Department  of  the  Navy 


Chief  Information  Officer  (Acting) 
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OFFICE  OF  THE  SECRETARY 


DEPARTMENT  OF  THE  AIR  FORCE 

WASHINGTON  DC 


28  February  2016 


MliMORANDl  M  FOR  OFITCF  <>l  TRK  INSPECTOR  GENERAL  l>()0 
FROM;  SAP 'CIO  A6 

XURIK  T-  Draft  Report  Project  \To  li?o i Mjnflfliir-nn?  nm  -  DolTs  Efforts  to Cnmoii&te 
Data  Centers  Need  Improvement 

Reference:  (a)  OIG  DOD  Draft  Report  Project  No,  0201 5-DIJ00RC-01 57,000,  DoD's  Efforts  to 
Consolidate  Data  Centers  Need  Improvement,  29  January  2016 

L  ’Thank  you  for  the  opportunity  to  review  and  comment  on  subject  report,  specifically 
recommendation  B.2.  We  were  aware  of  shortcomings  with  our  data  center  inventory  and 
advised  you  accordingly  during  the  investigation  portion  of  subject  project.  Moreover,  we  are 
committed  to  providing  DoO  and  OMB  timely  and  accurate  information  IAW  published 
guidance  regard  in  £  our  data  centers. 

2.  lb  that  end,  my  organization  has  taken  initiatives  to  improve  the  quality  and  completeness  <>« 
our  data.  Copies  of  the  fol  lowing  memos  are  attached; 

a.  On  16  July  2015. 1  issued  &  strategic  communication  memorandum  to  MAICQM  vice 
dbffimfttiders  (2-star)  outlining  our  way  ahead,  which  included  inventory  cleanup.  Thin 
memorandum  also  stressed  that  data  center  consolidation  was  relevant  to  all  fUnCLioital  areas  and 
should  be  communicated  to  all  levels  within  Iheir  orgniii^uLiori- 

h.  On  18  August  2015. 1  issued  another  memorandum  lb  MAJCGM  vice-ebrnmanders 
asking  them  to  validate  data  center  information  by  18  October  2015  1  also  reminded  them  dial 
we  are  required  to  perform  a  certification  of  data  every  six  inomlis  and  ihat  funding  would  Lie 
blocked  for  all  data  centers  not  accurately  registered  within  the  authoritative  database, 

c.  On  20  January  2016.  I  learned  with  the  Senior  Acquisition  Executive  (SAJ7AQ)  to 
issue  a  jointly  signed  memorandum  to  all  Air  Force  contracting  officers  and  Program  Executive 
Officers,  This  memo  reminded  them  of  existing  guidance  and  warned  that  all  contracting  actions 
acquiring  relev  ant  items  without  SAP  CIO  A6  approval  were  to  he  halted.  This  approv  al 
includes  validation  and  certification  of  data  center  inventory  information. 

3.  I  will  continue  to  press  for  improvement  of  the  completeness  and  accuracy  of  data  center 
information  and  am  committed  to  ensuring  vve  are  appropriately  tracking  all  relevant  assets  and 
providing  timely  reports  to  the  DoD  CIO  My  POCs  are  listed  below  and  would  be  happy  lo 
provide  additional  information  regarding  our  data  center  initiatives. 
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WtM  JAM  l  BENDER.  Ijrutciit.nl  Gcneial.  l  SM' 
Chief,  Information  Dominance  and 
Ch  i  e  f  In  fomml  ion  Of II mr 


3  AUndimcuta. 

1.  Data  Center  Consolidation  Strategic 'Communication  Memo.  16  Jul  15 

2.  JKL  IM  Data  Cleanup  Memo,  18  Aug  15 

3.  Obligation  ufFupcU  for  Data  Centers  and  Servers  Dual  Sig  Memo.  20  Jan  16 
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DEFENSE  INFORMATION  SYSTEMS  AGENCY 

n,  0  BOM  wo 

m+j|  mfaiii-  .MA.WVl.Auh  'n,',vs  i  ’44 


25-Feb-2016 

MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 

SUBJECT :  DISA's  oommaHs  to  Dial!  Report  on  DoDN  E  Hot  Is  to  Consolidate  Da  La  Centers 
Need  IrnproveinenU  January  2 A  2016,  (Project  No.  D2015-D000RC-0137) 

1 .  The  Defense  Information  Systems  Agency  (DISA')  has  reviewed  the  draft  report  referenced 
above  and  provides  comments  as  attached.  These  comments  are  meant  to  provide  clarity  to  the 
recommendations.  We  thank  the  DoD  IG  audit  team  tor  the  opportunity  to  participate  in  this 
andil  anti  hope  we  provided  use  fid  information  in  complete  this  task. 

2.  Wc  look  forward  to  continuing  to  work  with  yoii  and  your  staff  in  tire  future,  Any  questions 
your  staff  may  have  concerning  matters  for  the  recomrnondatiojis  should  be  directed  to 

Please  do  not  hesitate  to  contact  them  should  you 

need  to  further  discuss  tins  matter. 

HICKEY 
JOSEPty  R 

u  to  W  1 7  - 1 T  :2r  i-Tm 

JOHN  J.  MICKEY,  JR 
Chief  Information  Officer 
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DOD  1G  DRAFT  REPORT  DATED  JANUARY  29,  2016 
(PROJECT  NO.  D2015  D0G0RC  0137,000) 

“DOD’S  EFFORTS  TO  CONSOLIDATE  DATA  CENTERS  NEED  IMPROVEMENT” 

DEFENSE  INFORMATION  SYSTEMS  AGENCY  COMMENTS 
TO  DOD  It;  RECOMMENDATIONS 


RECOMMENDATION:  The  Chief  Information  Officer.  Department  oftlie  Army;  Deputy 
Department  of  the  Navy  Chief  Information  Officer-Navy,  Department  of  the  Navy;  Chief 
Information  Office,  Office  of  the  Secretary  of  the  Air  Force:  Deputy  Department  of  the  Navy 
Chief  hi  formation  Officer-Marine  Corps,  Department  of  the  Navy;  and  Chief  Information 
Officer,  Defense  Information  Systems  Agency  revise  their  current  processes  for  validating  data 
center  information  to  ensure  the  accuracy  and  completeness  of  information  reported  to  the  DoD 
Chief  Information  Officer. 

DISA  RESPONSE:  Partially  Concur 

DISA  still  does  not  agree  with  the  revised  OMB  definition  of  a  data  center  “.  ..as  a  closet,  room, 
lloor.  or  building  for  the  storage,  management,  and  dissemination  of  data  and  information  that 
contains  computer  systems  and  associated  components,  such  a.s  databases,  applications,  storage 
systems,  and  data  stores.'* 

The  definition  is  loo  broad  and  includes  almost  any  facility  that  has  a  closet  required  to  enable 
workstations  or  extend  network  connectivity,  \fhe  confusion  over  this  new  definition  is  not  even 
highlighted  in  the  report  and  instead  we  want  to  highlight  non- compliance  for  a  standard  that  was 
not  defined  properly  and  is  commercially  and  governmental ly  unacceptable. 

DISA  does  not  consider  Chain  bersburg.  PA  a  data  center.  It  is  an  operational  unit  conducting 
cybersecurity  missions  including  testing  new  standards,  responding  to  incidents,  inspecting 
Combat  iuit  Commands  ■'Services  Agencies  (C  S  A)  and  red  teaming  DoD  networks.  DISA 
CONUS  (Scott  AFB)  is  also  an  operational  unit  conducting  defensive  cyber  operation  using  "big 
data  analytics"  that  are  stored  and  processed  in  Defense  Enterprise  Computing  Centers  (DECO) 
facilities  not  Scott  AFB, 

DISA  has  been  working  with  DITCO  Scott  Data  Center  Inventory  Management  (DCIM)  entry 
being  labeled  as  "CLOSED."  The  older  equipment  in  this  building  was  planned  to  move  several 
years  ago.  but  technical  and  performance  challenges  slopped  the  execution  oftlie  total  move  of 
all  the  equipment  DISA's  plan  is  to  conduct  the  engineering  analysis  required  to  support  the 
movement  of  the  remaining  items.  DCIM  will  be  updated  to  show  "Open"  for  this  DITCO  Scott 
AFB  until  this  project  is  completed. 

Recommend  DoD  1G  highlight  the  definition  as  a  challenge  across  DoD  and  include  subject 
experts  in  a  rewrite  of  new  data  center  definition  to  ensure  it  is  executable  and  measurable  as  it 
relates  to  inlent  oftlie  law  and  efficiency  that  are  planned  as  part  of  the  con  soli  dal  ion 
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DISA  will  continue  to  follow  the  pop  CIO  Memorandum  'Changes  in  DoD  l>iiia  Center 
Inventory  and  Consolidation  Implementation  Plan  Reporting  Requirements.  .11  March  2015." 
We  will  provide  clear  guidance  regarding  DCIM  and  dal  a  center  reporting  requirements 
throughout  DISA  by  creating  a  DISA  Instruction  and  publishing  Dateline  DISA  articles  to  help 
disseminate  this  information  across  the  agency. 

Within  DCIM.  each  data  center  owner  will  identify  a  point  of  contact  ihal  will  he  responsible  lor 
ensuring  Ihe  informal  inn  in  DC  I'M  is  valid  and  aeeurale  nn  a  semi  -annual!  basis  11  v  DI.SA  CIO 
will  continue  to  execute  data  center  validation  reports  and  monitor  compliance  status  via  annual 
spot  checks  of  all  its  facilities., 

DISA  plans  to  complete  these  process  revisions  no  Inter  than  Q4  LA"  16. 


jdating  data  center  information  is 
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Acronyms  and  Abbreviations 

ADCCP  Army  Data  Center  Consolidation  Plan 
AFB  Air  Force  Base 
CDC  Core  Data  Center 
CIO  Chief  Information  Officer 
DCIM  Data  Center  Inventory  Management 
DDCIO  Deputy  Chief  Information  Officer 
DISA  Defense  Information  Systems  Agency 
DON  Department  of  the  Navy 
FDCCI  Federal  Data  Center  Consolidation  Initiative 
GAO  Government  Accountability  Office 
IPN  Installation  Processing  Node 
IT  Information  Technology 
OMB  Office  of  Management  and  Budget 
SPPN  Special  Purpose  Processing  Node 
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U.S.  Department  of  Defense 


The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions 
on  retaliation,  and  rights  and  remedies  against  retaliation  for 
protected  disclosures.  The  designated  ombudsman  is  the  DoD  Hotline 
Director.  For  more  information  on  your  rights  and  remedies  against 
retaliation,  visit  www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

congressional@dodig.mil;  703.604.8324 

Media  Contact 

public.affairs@dodig.mil;  703.604.8324 

For  Report  Notifications 

http://www.dodig.mil/pubs/email_update.cfm 

Twitter 

twitter.com/DoD_IG 


DoD  Hotline 

dodig.mil/hotline 


